Path Traversal Vulnerability in WebDyne by ASPEER
CVE-2026-78189

Currently unrated

Key Information:

Status
Vendor
CVE Published:
31 October 2026

What is CVE-2026-78189?

WebDyne versions prior to 3.022 are susceptible to a path traversal vulnerability via the PSGI API route fallback. When requests do not match any existing files, the PSGI handler reprocesses them as potential API requests using api_filename. This mechanism fails to adequately sanitize the request paths, allowing an attacker to exploit '..' sequences. Consequently, an attacker can execute embedded Perl scripts from .psp files located outside the intended document root, leading to unauthorized access and execution of potentially harmful scripts.

References

https://metacpan.org/release/ASPEER/WebDyne-3.022/changes
release-notes

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.